CVE-2026-43124None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: pstore: ram_core: fix incorrect success return when vmap() fails In persistent_ram_vmap(), vmap() may return NULL on failure. If offset is non-zero, adding offset_in_…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
pstore: ram_core: fix incorrect success return when vmap() fails
In persistent_ram_vmap(), vmap() may return NULL on failure.
If offset is non-zero, adding offset_in_page(start) causes the function to return a non-NULL pointer even though the mapping failed. persistent_ram_buffer_map() therefore incorrectly returns success.
Subsequent access to prz->buffer may dereference an invalid address and cause crashes.
Add proper NULL checking for vmap() failures.
Linux >= 831b624df1b420c8f9281ed1307a8db23afb72df < d47234840aeb4182ed3ee795c578b1dfa9cbd25bLinux >= 831b624df1b420c8f9281ed1307a8db23afb72df < 49918dd52615097529811d21ec6074dd02ebe77cLinux >= 831b624df1b420c8f9281ed1307a8db23afb72df < 8baa234181f632cabacf73e4834a910859e9fcc9Linux >= 831b624df1b420c8f9281ed1307a8db23afb72df < 1da904e84de608907662ad8a51ba9c571d61e003Linux >= 831b624df1b420c8f9281ed1307a8db23afb72df < 8d849adfbc3e98417fb541620568db1a759ef441Linux >= 831b624df1b420c8f9281ed1307a8db23afb72df < 2c99326dc1c79b7ce3c8dd92929b5ce724ff70ebLinux >= 831b624df1b420c8f9281ed1307a8db23afb72df < 88d5b28f63c7aac1271784e3b800ed405d1cde75Linux >= 831b624df1b420c8f9281ed1307a8db23afb72df < 05363abc7625cf18c96e67f50673cd07f11da5e9Linux 9095f19baae92afb978f8df77d19280fe291b337Linux 36a9916189b46b78dbf4fa542739b464444f0537Linux 1cd01dba1355e291f636555b1920625ed58c1623Linux 7026e2457c5b0c0e8a81e65a8209b8420a437b4dLinux 1e5b387747ba285a64348b9a96b246d0b9d52b03Linux d0028f48b33086cf6d8f87831a650866107b5785Linux >= 3.16.62 < 3.17Linux >= 3.18.123 < 3.19Linux >= 4.4.158 < 4.5Linux >= 4.9.129 < 4.10Linux >= 4.14.72 < 4.15Linux >= 4.18.10 < 4.19Linux 4.19Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses